[SRU] virt-aa-helper: allow riscv64 EDK II

[Heinrich Schuchardt]

[ Impact ]

Apparmor does not allow libvirt to use EDK II provided by package qemu-efi-riscv64 installed in the default path.

Upstream has accepted a patch for the virt-aa-helper:
https://gitlab.com/libvirt/libvirt/-/commit/c63bdd17b9f5c31a2511f173d60455b83d22c561

[ Test Plan ]

Install libvirt-clients libvirt-daemon libvirt-daemon-system.

Create a libvirt instance with 'virsh define my.xml' where my.xml has the following content:

<?xml version="1.0"?>
<domain type="qemu">
  <uuid>1a35d812-d84c-42c3-a21d-6c67a6c5db06</uuid>
  <name>ubuntu24.04-riscv64</name>
  <os>
    <type arch='riscv64' machine='virt'>hvm</type>
    <loader readonly='yes' type='pflash'>/usr/share/qemu-efi-riscv64/RISCV_VIRT_CODE.fd</loader>
    <nvram type='file' template='/usr/share/qemu-efi-riscv64/RISCV_VIRT_VARS.fd'>
              <source file='/home/ubuntu/RISCV_VIRT_VARS.fd'/>
  </nvram>
    <boot dev='hd'/>
  </os>
  <memory unit="MiB">512</memory>
  <vcpu placement="static">2</vcpu>
  <cpu match='exact'>
    <model>rv64</model>
    <topology sockets='1' cores='2' threads='1' />
  </cpu>
  <devices>
    <emulator>usr/bin/qemu-system-riscv64</emulator>
    <rng model='virtio'>
      <backend model='builtin'/>
    </rng>
    <console type="pty">
      <target type="serial" port="0"/>
    </console>
  </devices>
</domain>

It should be possible to launch the VM but the following is observed

$ virsh start ubuntu24.04-riscv64 && virsh console ubuntu24.04-riscv64 --safe
error: Failed to start domain 'ubuntu24.04-riscv64'
error: internal error: cannot load AppArmor profile 'libvirt-1a35d812-d84c-42c3-a21d-6c67a6c5db06'

User libvirt-qemu needs access (R+X) to the directory with the copy of /usr/share/qemu-efi-riscv64/RISCV_VIRT_CODE.fd.

[ Where problems could occur ]

Launching the RISC-V virtual machine with EDK II might still fail.

[ Other Info ]

Merge request in Debian:
https://salsa.debian.org/libvirt-team/libvirt/-/merge_requests/246

[Christian Ehrhardt (paelzer)]

Intention LGTM, to SRU Noble let us not forget about Oracular - added a bug task.

Will you coordinate with Sergio to not conflict with our continuous libvirt uploads or do you ask him to make it part of the next one?

[Heinrich Schuchardt (xypron)]

Hello Christian,

I already added Sergio as reviewer on my merge request.

Best regards

Heinrich

[Heinrich Schuchardt (xypron)]

Merge request https://code.launchpad.net/~xypron/ubuntu/+source/libvirt/+git/libvirt/+merge/478070

[Heinrich Schuchardt (xypron)]

Merge request for Oracular
https://code.launchpad.net/~xypron/ubuntu/+source/libvirt/+git/libvirt/+merge/478081

[Heinrich Schuchardt (xypron)]

Merge request for Noble
https://code.launchpad.net/~xypron/ubuntu/+source/libvirt/+git/libvirt/+merge/478083

[Sergio Durigan Junior (sergiodj)]

FWIW, the SRUs will have to wait until https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/2083986 clears the queue.

[Sergio Durigan Junior (sergiodj)]

Also, this will go with https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/2084136

[Launchpad Janitor (janitor)]

This bug was fixed in the package libvirt - 10.10.0-1ubuntu2

---------------
libvirt (10.10.0-1ubuntu2) plucky; urgency=medium

  * d/control: Make libvirt-daemon Suggest (instead of Recommend)
    libvirt-daemon-plugin-sanlock, which is in universe.

libvirt (10.10.0-1ubuntu1) plucky; urgency=medium

  * Merge with Debian unstable (LP: #2085246). Remaining changes:
    - Disable libssh2 support (universe dependency)
    - d/control: add libzfslinux-dev to build-deps
    - d/control: drop libvirt-lxc, vbox and xen drivers to suggest
    - debian/patches/ubuntu/ovmf_paths.patch: adjust paths to secboot.fd UEFI
      Secure Boot enabled variants of the OVMF firmware and variable store for
      the paths where we ship these files in Ubuntu.
    - Set qemu-group to kvm (for compat with older ubuntu)
    - Additional apport package-hook
    - Autostart default bridged network (As upstream does, but not Debian).
      In addition to just enabling it our solution provides:
      + do not autostart if subnet is already taken (e.g. in guests).
      + iterate some alternative subnets before giving up
    - d/p/ubuntu/Allow-libvirt-group-to-access-the-socket.patch: This is
      the group based access to libvirt functions as it was used in Ubuntu
      for quite a long time.
      + d/p/ubuntu/daemon-augeas-fix-expected.patch fix some related tests
        due to the group access change.
      + d/libvirt-daemon-driver-qemu.postinst*: add users in sudo to the libvirt
        group.
    - Update README.Debian with Ubuntu changes
    - d/p/ubuntu/ubuntu_machine_type.patch: accept ubuntu types as pci440fx
    - fix autopkgtests (LP 1899180)
      + d/t/control, d/t/smoke-qemu-session: fixup smoke-qemu-session by making
        vmlinuz available and accessible (Debian bug 848314)
      + d/t/control: fix smoke-qemu-session by ensuring the service will run
        installing libvirt-daemon-system
      + d/t/smoke-lxc: fix smoke-lxc by ignoring potential issues on destroy as
        long as the following undefine succeeds
      + d/t/smoke-lxc: use systemd instead of sysV to restart the service
      + d/t/control, d/t/smoke-lxc: retry service restart and skip test if
        failing; This was flaky on some release/architectures
      + d/t/smoke-lxc: retry check_domain being flaky on arm64
    - dnsmasq related enhancements
      + run dnsmasq as libvirt-dnsmasq (LP 1743718)
      + d/libvirt-daemon-driver-qemu.postinst*: add libvirt-dnsmasq user and group
      + d/libvirt-daemon-driver-qemu.postrm*: remove libvirt-dnsmasq user and group
        on purge
      + d/p/ubuntu/dnsmasq-as-priv-user: write dnsmasq config with user
        libvirt-dnsmasq and adapt the self tests to expect that config
      + d/libvirt-daemon-system.postinst: fix old libvirt-dnsmasq users group
      + Add dnsmasq configuration to work with system wide dnsmasq-base
    - d/p/ubuntu/set-default-machine-to-ubuntu.patch: to select default
      machine type correctly with newer qemu/libvirt
    - d/p/ubuntu/lp-1861125-ubuntu-models: recognize Ubuntu models for
      (LP 1861125) fixups
    - d/p/ubuntu/wait-for-qemu-kvm.patch - avoid hangs on startup (LP 1887592)
    - d/libvirt-...

[Heinrich Schuchardt (xypron)]

@Sergio: LP 2083986 is fixed, release. Is there still a blocker for the SRU pull requests?

[Sergio Durigan Junior (sergiodj)]

Hello Heinrich,

I'm preparing the new upload now.

[Sergio Durigan Junior (sergiodj)]

Uploaded to Noble:

$ dput libvirt_10.0.0-2ubuntu8.6_source.changes
Trying to upload package to ubuntu
Checking signature on .changes
gpg: /home/sergio/work/libvirt/libvirt_10.0.0-2ubuntu8.6_source.changes: Valid signature from 106DA1C8C3CBBF14
Checking signature on .dsc
gpg: /home/sergio/work/libvirt/libvirt_10.0.0-2ubuntu8.6.dsc: Valid signature from 106DA1C8C3CBBF14
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading libvirt_10.0.0-2ubuntu8.6.dsc: done.
  Uploading libvirt_10.0.0-2ubuntu8.6.debian.tar.xz: done.
  Uploading libvirt_10.0.0-2ubuntu8.6_source.buildinfo: done.
  Uploading libvirt_10.0.0-2ubuntu8.6_source.changes: done.
Successfully uploaded packages.

[Sergio Durigan Junior (sergiodj)]

Uploaded to Oracular:

$ dput libvirt_10.6.0-1ubuntu3.2_source.changes
Trying to upload package to ubuntu
Checking signature on .changes
gpg: /home/sergio/work/libvirt/libvirt_10.6.0-1ubuntu3.2_source.changes: Valid signature from 106DA1C8C3CBBF14
Checking signature on .dsc
gpg: /home/sergio/work/libvirt/libvirt_10.6.0-1ubuntu3.2.dsc: Valid signature from 106DA1C8C3CBBF14
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading libvirt_10.6.0-1ubuntu3.2.dsc: done.
  Uploading libvirt_10.6.0-1ubuntu3.2.debian.tar.xz: done.
  Uploading libvirt_10.6.0-1ubuntu3.2_source.buildinfo: done.
  Uploading libvirt_10.6.0-1ubuntu3.2_source.changes: done.
Successfully uploaded packages.

[Simon Quigley (tsimonq2)]

Unsubscribed sponsors, feel free to re-subscribe us if you need anything further here. :)

Thanks for sponsoring, Sergio!

[Andreas Hasenack (ahasenack)]

Hello Heinrich, or anyone else affected,

Accepted libvirt into oracular-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/libvirt/10.6.0-1ubuntu3.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-oracular to verification-done-oracular. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-oracular. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Andreas Hasenack (ahasenack)]

Hello Heinrich, or anyone else affected,

Accepted libvirt into noble-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/libvirt/10.0.0-2ubuntu8.6 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-noble to verification-done-noble. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-noble. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted libvirt (10.6.0-1ubuntu3.2) for oracular have finished running.
The following regressions have been reported in tests triggered by the package:

ceilometer/2:23.0.0-0ubuntu2 (i386, s390x)
cockpit-machines/unknown (amd64)
libvirt-python/unknown (amd64)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/oracular/update_excuses.html#libvirt

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

[Heinrich Schuchardt (xypron)]

The test for ceilometer on s390 seems to be flaky: 1 out of 3 runs passed.

cockpit-machines, libvirt-python passed after retriggering.

[Heinrich Schuchardt (xypron)]

On Ubuntu 24.04.1 amd64 with packages

qemu-system-misc=1:8.2.2+ds-0ubuntu1.5
qemu-efi-riscv64=2024.02-2ubuntu0.1
libvirt-daemon=10.0.0-2ubuntu8.6
libvirt-clients=10.0.0-2ubuntu8.6

I was able to define and start a riscv64 virtual machine using EDK II using above xml.

[Heinrich Schuchardt (xypron)]

On Ubuntu 24.10 amd64 with packages

qemu-system-misc=1:9.0.2+ds-4ubuntu5.2
qemu-efi-riscv64=2024.05-2ubuntu0.1
libvirt-daemon=10.6.0-1ubuntu3.2
libvirt-clients=10.6.0-1ubuntu3.2

I was able to define and start a riscv64 virtual machine using EDK II using above xml.

[Launchpad Janitor (janitor)]

This bug was fixed in the package libvirt - 10.6.0-1ubuntu3.2

---------------
libvirt (10.6.0-1ubuntu3.2) oracular; urgency=medium

  [ Heinrich Schuchardt ]
  - d/p/ubuntu-aa/virt-aa-helper-allow-riscv64-EDK-II.patch
    virt-aa-helper: allow riscv64 EDK II (LP: #2091357)

 -- Sergio Durigan Junior <email address hidden> Mon, 20 Jan 2025 19:14:51 -0500

[Andreas Hasenack (ahasenack)]

The verification of the Stable Release Update for libvirt has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Christian Ehrhardt (paelzer)]

Thanks for releasing for oracular, Noble is also just as ready but held back for the 24.04.2 spins.
I expect that to be released soon after that one is out.

[Launchpad Janitor (janitor)]

This bug was fixed in the package libvirt - 10.0.0-2ubuntu8.6

---------------
libvirt (10.0.0-2ubuntu8.6) noble; urgency=medium

  - d/p/u/lp-2084136-fix-get-number-block-io-throttle-params.patch:
    Fix issue preventing the user to obtain the number of block I/O
    parameters. (LP: #2084136)

  [ Heinrich Schuchardt ]
  - d/p/ubuntu-aa/virt-aa-helper-allow-riscv64-EDK-II.patch
    virt-aa-helper: allow riscv64 EDK II (LP: #2091357)

 -- Sergio Durigan Junior <email address hidden> Mon, 20 Jan 2025 14:38:05 -0500